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We assess the security of a quantum key distribution protocol relying on the transmission of 
Gaussian-modulated coherent states and homodyne detection. This protocol is shown to be equiv- 
alent to a squeezed state protocol based on a CSS code construction, and is thus provably secure 
against any eavesdropping strategy. We also briefly show how this protocol can be generalized in 
order to improve the net key rate. 
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\ Quantum Key Distribution (QKD) uses quantum mechanics toprovide two parties (Alice and Bob) with a secret 
^ • key, which they can later use to encrypt confidential information [ij. Unlike classical key distribution, QKD relies, at 
O ' least in principle, on no computational assumption, but only draws its validity from the laws of quantum mechanics. 
The resources needed for QKD always comprise a source of non-orthogonal quantum states on Alice's side, a quantum 
' channel conveying these states to Bob, a measuring apparatus on Bob's side, and a (public) authenticated classical 
channel between Alice and Bob. QKD protocols generally consist in two (intertwined) parts. One part consists in 
y—i • probing the quantum channel to determine whether it is possible to securely transmit the key over it. The use of 
^ non-orthogonal quantum states allows to achieve this task. The other part consists in the explicit distillation of the 
OO . secret key. 

■ Most interest in QKD has been devoted to protocols involving (an approximation to) a single-photon source on 
~? . Alice's side and a single-photon detector on Bob's side P, Q- However, protocols involving quantum continuous 

I variables have latelybeen considered with an increasing interest 0; S S B 13 • Of special importance are "coherent- 
, state" protocols The quantum source at Alice's side then randomly generates coherent states of a light mode 

' with a Gaussian distribution, while Bob performs homodyne measurements. These protocols are very important 
because they seem to allow for facilitated implementations and much higher secret-key generation rates than the 
protocols involving single-photon sources 9J • 

In this paper, we will constructively prove that secure coherent-state protocols relying on homodyne detection 
. exist. A first security analysis of coherent-state protocols has been carried in but only individual Gaussian 

■ eavesdropping strategies were considered. We here want to address a more general setting and allow a potential 
^ , eavesdropper (Eve) to probe the quantum channel between Alice and Bob in any manner she pleases. We want to 
O^" establish the security of coherent-state protocols against arbitrary collective attacks (thereby extending ^3)- The 
^ importance of our result lies in that it shows that no non-classical feature of light, such as squeezing, is necessary 

in continuous-variable quantum cryptography: coherent states, homodyne detection, and well-chosen communication 
procedures are sufficient for Alice and Bob to securely distill a secret key. 



II. SQUEEZED-STATE PROTOCOLS 

The basic ingredient that we shall use in the remaining is the argument used in fTll| to prove that the BB84 protocol 
is secure, against any eavesdropping strategy, when the procedures used for error correction and privacy amplification 
are derived from a CSS quantum error-correcting code |12lll3j| . Let us start with a brief review of this argument. 

It is well known that quantum error-correcting codes provide a means to perform entanglement purification with 
one-way communication 14]. If two parties, Alice and Bob, share N noisy entangled qubit pairs, their situation is 
fully equivalent to a situation where Alice would have prepared N pairs, all in the Einstein-Podolsky- Rosen (EPR) 
state: 

= i=(|oo) + 111)), (1) 
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and would have kept half of each pair for herself while sending all other halves to Bob through some noisy quantum 
channel. The effect of this channel on the state can be modeled as if the state cither remains unaltered or undergoes 
either one of the three following "errors": bit-flip, 0+ — > -0+, or phase-flip, 0^ or both, 0+ -0^, where 

= 75(100) - |11)) and |0±) = 7|(|01) ± |10)). In the latter situation, Alice and Bob could get pure EPR pairs 

upon Alice using a quantum error correcting code (QECC) to protect the halves sent to Bob from the noise effected 
by the channel. Equivalently, in the former situation, Alice and Bob can get CN pairs in the state (C < 1) upon 
Alice and Bob measuring the syndromes (or error patterns) of some QECC, Alice communicating the values of her 
syndromes to Bob, and Bob performing error correction so as to align the values of his syndromes on those of Alice. 
C is then the rate of the used quantum code. It is trivial to achieve secure QKD from entanglement purification 
because if Alice and Bob share a 2-qubit system in the state they certainly can extract a secret bit from it. 

A (binary) CSS code is a 2'^-dimensional subspace of the Hilbert space of n qubits {k < n). Such a code belongs 
to the class of so-called stabilizer codes, i.e. they are defined as the eigenspace of a set of mutually commutating 
operators {Oi, . . . , Ox}, the stabilizer generators. The essential feature of a CSS code is that all stabilizer generators 
are either of the form X^^ (g) . . . (g) AT*" or of the form Z^^ (g) . . . (g) Z**", where X\i) — l),Z\i) = (— )*|i), and where 
(si, . . . , Sn) & {0, 1}". Because of this feature, it is possible to prove that entanglement purification using a CSS code 
followed by key extraction is fully equivalent to a quantum cryptographic protocol with BB84 as a physical part and 
suitable error correction and privacy amplification as classical post-processing part These procedures read as 

follows. Let the binary vectors 3C and %' denote respectively Alice's and Bob's raw key bits, and let 62 C Ci denote 
two embedded n-bit classical linear codes, with parity check matrices respectively Hi and H2 |lB|. Alice announces 
the syndrome HiOC — Bob corrects X' to the nearest vector %" such that Hi%" = £^ (error correction). With 
high probability, %" = %. The key is then reduced to i?23C (privacy amplification). 

Entanglement purification using CSS codes is (asymptotically) achievable as long as the bit-flip probability ef, and 
the phase-flip probability Cp satisfy 

C = 1 - /i(eb) - /i(ep) > 0, (2) 

where h{x) = — log2a;^(l — a;)'^^"^-' denotes the binary Shannon entropy ^Jl- Equivalently, the BB84 protocol will 
allow Alice and Bob to distill a secret key using the error correction and privacy amplification we have described if 
the error rates for two conjugate bases satisfy Eq.Q. 

From QKD schemes based on entanglement purification of qubits, it is possible to derive a secure QKD scheme 
using squeezed states and homodyne detection, which is in spirit very close to the BB84 protocol Let us present 
this scheme in a slightly modified form. Let x and p denote two conjugate quadratures of a single mode of the 
electromagnetic field ([i,p] — i). Alice creates (about) 4A^ quantum oscillators in a squeezed state. She draws a 
47V-bit string b to decide for each of the AN oscillator whether it will be prepared in an x-squeezed state or in a 
p-squeezed state. Also, for each oscillator, she draws a real value x (or p) according to a probability distribution 
^pos(a;) (or Pmom(p)), and sends Bob an x- (or p-)squeezed state centered on {x,Q) (or (0,p)). Bob receives the states 
and decides at random to measure them either in the x-basis or in the p-basis. By public discussion, Alice and Bob 
discard the oscillators for which Alice's choice of preparation and Bob's choice of measurement don't match. Alice 
and Bob should now have a list of (about) 2A^ correlated real values [xi, x'^) . . . {x2n, a^2Ar) from which they wish to 
extract bits. To do so, they proceed as follows. For each real value, x, Alice decomposes x as 

x=iSix) + Six))y^ (3) 

where S{x) G Z, and reveals S{x) — ira.c{x/y/7T) (or S{p) — ira,c{p/ y/Tr)) to Bob. Alice's bit is the parity of S{x) 
(resp. S{p)). Bob subtracts S{x)\/tt from his corresponding real value, a;', and adjusts his result x' — S{x)y^ to the 
nearest integer multiple of ^/tt. The key bit will be if this integer is even, and 1 otherwise. At this point, Alice and 
Bob agree on a subset of size (about) N of their key elements that they use for verification. A bit error (resp. a phase 
error) occurs when Alice sends an x-squeezed state (resp. ap-squeezed state), and Alice's bit and Bob's bit mismatch. 
If the estimates of the error rates Cb and Cp satisfy Eq.©, Alice and Bob further proceed with error correction and 
privacy amplification as described above, and distill a secret key. 

Owing to the manner the real axis is binned to associate bits to real numbers, the bit error rate Cb is bounded 
by the probability that, when Alice sends an x-squeezed state centered on the value xq, |sq(xo)), and Bob performs 
an X homodyne measurement. Bob gets an outcome whose value differs from xq by a value greater than s/ii jl. The 
phase error rate, e^, can be bounded similarly. Therefore, even in the absence of eavesdropping, Cf, and Cp will 
be nonzero, due to finite squeezing. Quantifying squeezing with 10 logj^Q Jj-, where the states sent by Alice read 

|sq(xo)) ~ / dx e~('^~^")^/^'^^ |x) and |sq(po)) ^ J dp e~^P~P°^^ ^"^"^^ \p) , it was proven in '?| that a minimum of 2.51 dB 
of squeezing is necessary for the protocol to work. 
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III. CONVERSION TO COHERENT-STATE PROTOCOLS 



A. Asymmetric squeezed-state protocols 

A first step in the conversion to a coherent-state protocol is to observe that three modifications can be brought to the 
above squeezed-state protocol without weakening its security. First, as shown in 4], the above protocol is equivalent 
to a protocol where Alice reveals S{x) = bac{x/ay/TT) when using the x- quadrature, and S{p) — fra.c{pa/y/Tr) when 
using the p quadrature, where a is some positive real parameter. Such an asymmetric protocol allows Alice to squeeze 
unequally x and p quadratures. The squeezing should only be such that Eq.(|2Il is obeyed. In particular, Alice can use 
coherent states when encoding in the x quadrature, if when encoding in the p quadrature, she uses a state exhibiting 
a squeezing of at least 3.37 dB. Our second observation concerns the method used by Alice for encoding. When she 
chooses to encode in the x-quadrature, she draws the value of x from Ppos and prepares a coherent state centered 
on (a;,0). Similarly, when encoding with the conjugate quadrature, she prepares p-squeezed states centered on (0,p). 
The decision to prepare states centered on (x, 0) or (0,p) relies on an arbitrary convention between Alice and Bob for 
the axis for x quadrature and the axis for p quadrature. Instead of sending a state centered on (a;,0) (resp. (0,p)), 
Alice could as well send a state centered on {x,p), when the key information is encoded in x (resp. in p), and where 
the value p (resp. x), drawn from some probability distribution Pposip) (resp. P4q,jj(x)), may in principle be publicly 
disclosed to allow Bob to re-translate the state on the x (or p) axis. Finally, we remark that the protocol is no less 
secure if Alice and Bob decide that the key is only encoded in the coherent states and never in the squeezed states. 
They can decide that about half of the time, Alice will send coherent states to transmit the key and to estimate Cf,, 
while about half of the time, Alice will send squeezed states to estimate Cp. This fact holds for BB84 as well: one can 
decide that the key is only encoded in Z eigenstates, and that X eigenstates are only sent to determine the phase 
error rate. As long as et and Cp satisfy Eq.(|21), the protocol will work safely. 

In summary, the following is a secure protocol. 

#1 Ahce prepares the state S = 5"^°'' (8) S^'^, where 

5™*^ = 5kcy 5*,^. (4) 

'S'key = 7(1) ® ■■■li^) is a tensor product of N coherent states, each drawn from a probability distribution 
Ppos{x)Ppas{p)- Also, S^^ = 7c(l)(8). . .(g)7c(/^) is a tensor product of coherent states, drawn from the same probabihty 
distribution Ppos{x)PpQs{p), and S^'^ = ct(1) (g) . . . (g) a{i') is a tensor product of p-squeezed states drawn from some 
probability distribution P^-^^^-^{x)Pniom{p)- The probability distributions Pposix)Pp^g(j)) and P^-^^^{x) Paiom{p) are such 
that 

dx dp Ppos(a;)Ppos(p) l{x,P) = y dx dp P4^„^(x)P,„om(p) cr{x,p), (5) 

where j{x,p) (resp. a{x,p)) denotes a coherent (resp. p-squeezed) state centered on {x,p). 

^2 Alice picks a random permutation tt S Sym(f/) {g — N + + 1/ denotes the total number of oscillators sent by 
Alice) and sends the state ttStt* to Bob. 

#2' Let the cp-map T : 23 (^K'^^) 23(J{®s) denote the quantum channel between Alice and Bob. T represents 
the (possibly collective) eavesdropping strategy used by Eve, !K is the Hilbert space of an oscillator and 23 (M**^) the 
space of bounded operators on . 

#3 After Bob acknowledges receipt, Alice reveals tt and Bob undoes the permutation: T{ttStt*) T'^{S) = 
tt*T{'kStt*)tt. Also, V:;' = 1 . . . ^, Ahce discloses the values of Xj = tr(a; 7c(j)), and Vj = \ . . .u, Alice discloses the 
values of = tr(p cr(j)). 

#4 Bob measures the following effects: 

X^''+^\xj) = l'^''+^-^ ®X{x,)®l'^s-(N+j). j^i...^. (6) 

where X{x,) = S^^,^^^^ dx \x){x\ + dx \x){x\ and F(p,) = J^^^^^^^ dp \p){p\ + dp \p){p\. 

N.B. each of these measurement has a yes/no outcome. Also note that Bob can as well measure these effects by 
performing a homodyne measurement on the corresponding oscillators, since after the measurements he no more 
needs these oscillators. 

#5 Let eb{j) denote the outcome of the jth measurement, j — 1 . . . fi [eb{j) = 1 if the effect X^^^^^ (xj)] is measured 
and et{j) — otherwise). Likewise, we define ep{j), j ~ 1 . . .v. If the estimates for the bit error rate and phase error 
rate, et = ^bii) and gp = ^ ^p{i) respectively, satisfy the CSS rate inequality Ahce and Bob proceed, 

as described above, to distill a secret key from the remaining oscillators S'key. 
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B. Estimation of the phase-error rate without squeezing 



To convert this last protocol to a secure coherent-state protocol, all we need is to prove that the phase error rate, 
Bp, can be estimated upon Alice sending only coherent states instead of squeezed states and Bob performing only 
homodyne measurements. In the following, g will denote again the total number of oscillators sent by Alice and M 
will denote a ("sufficiently large") integer. 

Let Sm and 5^, m — 1. . .M, denote two arrays of oscillators, each in a coherent state. Suppose that for all 
squeezed states cr(j), j — 1 . . . v, involved in the last protocol, Alice and Bob had a means to estimate the quantities 

M 

-^(J') = M E ^''(T^S^ ® a{j) ® 5:„)P(I^'"I+I)(p,)). (8) 

m— 1 

Then, the quantity $ = ^ X^J^i '^(i) would certainly be as reliable an estimator for the phase error rate as the 
quantity Cp Alice and Bob get in the modified squeezed state protocol. Now consider a situation where the first four 
steps of the last protocol are replaced by the following: 
Alice prepares the state 

K 

i?=^™h^5P^^ with5p,=(g)7r'> 

fc=i 

where 5''^°'' is given by Eq.Q and where {7^} denotes K different coherent states, which will be used instead of the 
p-squeezed states to estimate Cp. 

^2 Alice picks a random permutation tt G Syiii{g) and sends the state ttRt:* to Bob through the quantum channel. 

#2' Eve acts collectively: nRn* T{ttRtt*). 

#3 Bob acknowledges receipt of the oscillators, Alice reveals tt and Bob undoes the permutation T{ttRtt*) — > 
T^{R) ~ h*T{ttRtt*)tt. Also, Vj = 1 . . . /i, Alice reveals the values Xj — ix{x^c{j)), and Vj = 1 . . . i^, she reveals the 
values pj — tv{pfj{j)). 

#4 Vj = 1 . . . /i. Bob measures the effects X^^^^^ and Vfc = 1 . . .K^m ~ 1 . . . A/, Bob measures the effects 

p(W+/j+(fe-l)M+m) .-J 

Note that since Bob performs individual measurements, the action of Eve's collective channel is the same as if she 
were acting with individual channels t[ ,i = 1 . . . g {g — N + fi + KM denotes the total number of oscillators sent by 
Alice) defined, in Schrodinger picture, by 



Tf : S(Jf) ^ S(Jf) : p ^ Tr^.T" (7(^-1) (g) p (g) -f^s~'^), (9) 
ioT i = 1 . . . g, where Tr/^/ denotes the partial trace over all subsystems but the ith, and ^^'■~^'> (resp. 7(3"')) represents 

'ck- 



an array of {i — 1) (resp. {g — i)) consecutive coherent states from the g coherent states 5koy <Xi S^^^ S*^ 



Thus, in step #4, everything happens as if Bob were measuring P{pj) on r^i^k), i{k, m) = N + p + (k — l)M + m. 
Let f{i{k,m),j,k) denote the outcomes he obtains and let F{j,k) denote the mean value of these M outcomes. Due 
to the random permutation tt, if M is sufficiently large, we can be statistically confident that F{j, k) doesn't depend 
on the individual cp-map indices, i, chosen for the test, i.e. we can be statistically confident that for all M-uple of 
indices 1 < ii . . . i^/ < + + KM , would have Bob measured P{pj) on t^_^ (7^) . . . t^^^ (7fc), the obtained outcomes 

/(ii, j, k)... f{iM,j, k) would have been such that ^ Yl,m=i fiimj, k) « F(j, k). 
In particular, we can be statistically confident that 

1 

— 5]/(z(l,m),j,fc)«i^(j, fc), 

m— 1 

and a fortiori that 

M 



M 

m— 1 



- ^ tr[P(p,) {jk)]-F{j,k). 
That is, 

g J2 tr[P(^+''+")(pj)7^"(^'°'' ® 7^""' ® 7fe ® 7f ""^ ® <S> Tfe^"^)] ~ ^(^■' (10) 



M 

M 



m=l k'>l 
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Defining = 3''°^ (E) -/f""-\ S',-^ = ^""^ ® 0^,,^^ 7®^, the latter equation reads 

M 

- J2 tr(p(^+^+™) {p,)T^S^ ® 7fe ® S'J) « F{j, k). (11) 



m— 1 



Now let us introduce the operator 

= 17 E Tr Tr^(r:(p(^+^+™)(p,))(5„ ® 1 ® S'J), 

m 

where , the dual of T'^ defines evolution in Hcisenberg picture 0| (it is related to through the identity 
tr{T'^{p)A) = tT{pT^{A))), and where Dim (resp. Di'm) denotes the Hilbert space supporting the state Sm (resp. 
S'm)- With the help of £j, Ea. pi|) can be re-written as tr Ej-fk = F{j^k) and similarly Eq.® as = tr£j(T(j). It 
now only remains to prove that tr £jcr(j') can be inferred from the quantities -F(j, k) when the coherent states 7fc are 
correctly chosen. 

Let o-(j) = !?/'■')(?/'■' I and let X^n V'nl") denote the expansion of li/;-') in Fock basis. Since X„ IV'nP = 1j have 
Ve > 0, s.t. Er=3^,+i IV'^^P < e- Let 3^ = max,3^, and let us denote = Y.n=o ^iW) and \^'^') = - jV'^). 
We have 

Indeed, < £j < 1 and Cauchy-Schwarz inequality imply that (?/';j^'^|£j IV'h'^) < IIV'j^'^lP < ^ and that KV'^j-l^ilV'^j''^)! ^ 
Y^. Thus the knowledge of ('0^|£j iV'jj-) brings (in arbitrarily good approximation) the knowledge of (V'"' |£i IV'"')- Also, 
the quantities can be inferred from the (!N + 1)^ quantities (Z|£j|n), < n < !N. It thus only remain 

to show how to estimate these quantities. Let \ak) denote {Ji + 1)^ = K coherent states and let X^^o'^fcl'^) denote 
their expansions in Fock basis. The states \ak) are chosen such that 'Y1°^=n+i ["^feP < e,Vfc = 1 . . .K. Thus setting 
Ik = |afe)(afe|, we have 

N 

F{j,k)+7^k= circl{l\£,\n), (12) 

where \r]k\ < e + 2y/e. It is always possible to choose the values ak such that the matrix F = [F^''"^] = 
c[*c5! is invertible. Indeed, detF is of the form e~5 Et^=i I"'=I^Q(q;i, a^; aj^-), where Q is of the form 
12xfj.=o Q\ /i('^2, • ■ • , ciK] ci*2i ■ ■ ■ , a*j^)aia*i^ . Unless all coeflScients Q\ ^ are identically zero, detF only vanishes for a 
finite number of values of ai when all the values 0:2, ... , aK are fixed. Similarly, each polynomial Q\ ^ is of the form 
ijQt,uj{(^3i ■ ■ ■ i^K'jCil, . . . ,a*j^)a2a2^ , so that (again) unless all the coefficients Ql^^ are identically zero, Q\ ^ 
only vanishes for a finite number of values of 02 when all the values as, . . . , ax are fixed. And so on, continuing the 
reasoning, we see that we can always meet the condition detF ^ upon fixing aK to some value such that not all 
Q^,^^{ctK',Oi*j^) are zero, fixing aK-i to some value such that not all Q^~^{aK-i,OiK',a*K^i,ct'K) are zero, . . ., and 
fixing ai such that Q{ai, . . . , ax', a^) ^ 0. We see that inverting the relation Ea. p2|) will provide estimates 
for the quantities {l\Ej\n) (from which we infer the quantities tr£j(T(j)), and hence the phase error rate $. It is 
however important to note that these estimates will only be accurate if ||F"^77|| ^ ||F~^F(j)||, where = (770, . . . tTJk) 
and F(j) = {F{j, 0), . . . , F{j, K)). Therefore, Alice and Bob should add an additional step in the protocol where they 
check that this latter condition is indeed satisfied. 



IV. FURTHER EXTENSIONS 



Let us now sketch how this protocol can extended by relaxing the translational symmetry of the qubit encoding 
scheme so as to improve its efficiency and get closer to the effective key extraction procedure introduced in [l7j and 
implemented in . The technical details will be described in a forthcoming paper (IS] . In the same way we can split 
a real number into an integer and a fractional part as in Eq.©, we can encode m qubits in an oscillator with the 
following linear transformation (up to normalization) 

\x) \S{x))-, ® \Si{x))s, \Sm{x))s^, (13) 
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TABLE I: Bit and phase error rates and corresponding net key rates for a two-slice encoding as a function of the channel 
attenuation. 



which decomposes the oscillator into m qubit subsystems s^, i ~ l...m, and some continuous subsystem s. The 
functions Si{x), i = 1 . . .m, called slices, have range {0, 1}. They can be general, and in particular the bit values 
and 1 do not need be placed periodically on the x axis as in Instead, one can imagine the x axis cut into 2™ 
intervals, each assigned to m binary values S'i...m(a;) (see for more details). Then, S{x) (with range [0; 1]) is a 
continuous function that carries the remaining continuous information about x not contained in Si,,,m{x). Note the 
similarity with Eq.Q, where the bit value is in the parity of S{x) and the remaining continuous information in S{x). 
Similarly, Bob can also decompose his oscillator into m qubits (e^ , i = 1 . . . to) and one continuous subsystem (e) . 
These decompositions are chosen so as to get high entanglement purification rates Ri — 1 — h[e\) — h{e\) for the pairs 
Si&i, i = 1 . . .TO. The rate Ri of each slice is calculated by tracing out the other parts of the system, that is, as if 
the other slices are controlled by Eve. Consequently, the total number of secret bits produced per oscillator can be 
safely obtained by summing over the slices, R = Yl^i ^i- Following an argument similar to the one above, the bit 
and phase error rates, and e^, can be estimated from homodyne detection with arbitrary precision. 

To further improve the efficiency, the decomposition into the subsystems ei...„i may depend both on S{x) (e.g., like 
in the above protocol, where Bob uses S{x) to re-adjust his measured value) and on the bit value of the previous slices 
Sj^i{x). This allows Bob to estimate Alice's bits Sj (x) with the information already acquired from the correction of 
the bits Sj<^i{x), thereby improving the correlations 18]. 

For illustration, we have applied this "sliced" encoding to the special case of the noiseless attenuation channel, 
which is of practical importance. This corresponds to the simplest attack where Eve puts a beam-splitter in between 
two sections of a lossless line, sending vacuum at the second input port. Similarly to the implementation of the 
modulation variance of Alice was chosen equal to 31 x the vacuum noise in both quadratures, which gives Alice and 
Bob up to 2.5 common bits in the absence of losses. Using this encoding with two slices, we were able to get the 
net key rates described in Table The slices 5*1 and S2 are defined by dividing the real axis into four equiprobable 
intervals labeled by two bits, with Si {S2) being the least (most) significant bit. For the case with no losses, it is thus 
possible to distill R = 0.752 -I- 0.938 = 1.69 secret bits per oscillator, thus significantly improving the rate obtainable 
with the encoding of |^, namely, up to one bit per oscillator. Due to the higher bit error rate, it was not possible to 
distill secret bits in slice 1 with losses beyond 0.7 dB. It was however still possible to distill secret bits in slice 2 up to 
1.4 dB losses (about 10 km with fiber optics with losses of 0.15 dB/km). This value for the maximum tolerable loss 
does not stem from any fundamental reason, and might be improved by tuning the modulation variance and/or the 
functions Si and 6*2. 



V. CONCLUSIONS 



In summary, we have studied the security of Gaussian- modulated coherent-state protocols against arbitrary attacks. 
We have shown how to extend the protocol of Q to remove the need of squeezing for estimating the phase error 
rate. This quantity can also be estimated using coherent states modulated in two conjugate quadratures, homodyne 
measurements, and appropriate classical post-processing. The equivalence between the derived coherent-state QKD 
protocol and a squeezed state protocol, itself equivalent to a protocol based on EPR purification with CSS codes, 
assesses the security against arbitrary attacks, including collective and/or non-Gaussian attacks. This is compatible 
with the fact that coherent-state protocols have been shown to be equivalent to protocols involving entangled bipartite 
Gaussian states (Q- Also, we extended the encoding scheme of |^] in order to improve the net key rate. By 
transmitting more than one bit per oscillator in a manner derived from an effective reconciliation procedure llTj . 
numerical results have shown that a secret key can be extracted in an attenuation channel with significant loss. 
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